Bounty Economics

What the numbers are. Each programme's advertised maximum payout, which this page calls its ceiling; whether it promises safe harbour to a researcher who tests in good faith; the historical average hours reported by HackerOne programmes for first response, award and resolution; and how many programmes are live on the two web3 platforms. Every figure names the number of programmes it was computed from. A median is the middle value, and percentiles use linear interpolation over the programmes publishing a non-zero ceiling.

Where they come from. HackerOne, Bugcrowd, Intigriti, YesWeHack and Federacy come from arkadiyt/bounty-targets-data, an MIT-licensed mirror of the platforms’ directory data. Bugcrowd, HackerOne, Intigriti and YesWeHack were measured on 28 Oct 2026; Federacy retains its 08 Oct 2026 observation. Immunefi and Cantina each publish a public endpoint, read directly on 28 Oct 2026. YFarmX computes every aggregate from those files, and all seven platform records carry the marker Confirmed.

What they say. Across 1,143 programmes on seven platforms, the median Bugcrowd ceiling is $3,625 across the 292 of 297 programmes that publish one, 75 of 297 Bugcrowd programmes give less than full safe harbour, the median of HackerOne programmes’ reported resolution times is 1,154 hours, and Immunefi's median advertised ceiling is $150,000 across 148 live programmes.

The caveats. A ceiling is what a programme advertises, and the amount it will pay can be lower: 127 of Immunefi's 639 reward rows cap a critical at 10 per cent of the funds at risk. Asset counts are of machine-readable entries only: 13 of the 48 live Cantina programmes publish scope as prose, and the SpaceX/Starlink record on Bugcrowd carries one in-scope entry pointing at the human-readable brief. Intigriti's medians are kept per currency, €2,500 across 54 programmes, $8,500 across 14 and one at £12,500, because pooling euros, dollars and sterling produces a sort-order artefact, and YesWeHack publishes its 54 figures as bare numbers, so they are shown without a currency.

The dates in the log. Immunefi rows carry the programme's own launch date and Cantina rows the start of the timeframe the platform publishes, 196 rows in all. The five mirrored platforms publish no programme date, so their 947 rows show when each programme first entered this index. Those dates are retained at later updates and do not establish when a programme launched. These rows follow the dated programmes in the log's default order.

Reproduce it. One pull and one parse gives the Bugcrowd figures:

curl -sSL -o bugcrowd.json https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/main/data/bugcrowd_data.json
python3 -c "import json,statistics; d=json.load(open('bugcrowd.json')); m=[p['max_payout'] for p in d if p.get('max_payout')]; print(len(d), len(m), statistics.median(m), max(m))"

Read the field a hunter reads first on reading a bounty scope, and each platform's record under its name at the foot of the page.